# Roles and permissions Source: https://docs.qualflare.com/docs/administration/roles-permissions ยท Last updated: 2026-10-27 The five Qualflare roles from Guest to Owner, what each one can do in a workspace and in a project, how the two combine, and who sees each page. Qualflare has five roles, Guest, Viewer, Editor, Maintainer and Owner, and the same roles apply to a workspace and to each project; in a project you get the higher of your workspace role and your project role. ## Roles at a glance Each role adds a permission to the role before it: | Role | Adds | For example | | -------------- | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Guest** | Nothing at workspace level | Sees only the projects they were invited to, with the role they hold in each | | **Viewer** | Read | Browse test cases, [launches](https://docs.qualflare.com/docs/runs/launches), results, and [defects](https://docs.qualflare.com/docs/defects) | | **Editor** | Write | Create and edit [test cases](https://docs.qualflare.com/docs/test-management/test-cases), suites, launches, and defects; create [access tokens](https://docs.qualflare.com/docs/api/access-tokens) | | **Maintainer** | Manage members | Invite people (needs this role in the workspace), change roles, remove members, revoke access tokens | | **Owner** | Delete | Delete the workspace. Deleting a project needs the Owner role in both the workspace and that project | The same roles apply at workspace level and in each project. The person who creates a workspace is its Owner, and the person who creates a project gets the Owner role in it. Someone who wasn't in the workspace yet joins it as a **Guest** when they accept a project invitation. A Guest uses a team member seat like every other member, and Demote never returns anyone to Guest: it stops at Viewer. ## Permissions by role | Role | Read | Write | Manage members | Delete | | -------------- | ---- | ----- | -------------- | ------ | | **Guest** | No | No | No | No | | **Viewer** | Yes | No | No | No | | **Editor** | Yes | Yes | No | No | | **Maintainer** | Yes | Yes | Yes | No | | **Owner** | Yes | Yes | Yes | Yes | The four permissions are the same in a workspace and in a project, and each role has everything the roles above it in the table have. ## What each permission allows | Action | Scope | Permission | Least role | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | -------------- | ---------- | | Open **Users**, **Tags** and **Settings** | Workspace | Read | Viewer | | See a project's test cases, launches, results and defects | Project | Read | Viewer | | Create a project | Workspace | Write | Editor | | Use workspace **Integrations** | Workspace | Write | Editor | | Change **Help improve Qualflare AI** | Workspace | Write | Editor | | Save a project's **General**, **AI Features**, **Quality** and **Public report** settings | Workspace | Write | Editor | | Create and edit test cases, suites, launches and defects; create access tokens; assign a team | Project | Write | Editor | | Invite people to a project | Workspace | Manage members | Maintainer | | Promote, demote and remove workspace members; open **Audit Logs** | Workspace | Manage members | Maintainer | | Promote, demote and remove project members; revoke access tokens; create and manage teams | Project | Manage members | Maintainer | | Open [**Plan & Billing**](https://docs.qualflare.com/docs/administration/plans), **Single Sign-On**, **Verified Domains**, **SCIM Provisioning** and **Authentication** | Workspace | Delete | Owner | | Rename or delete the workspace; require [two-factor authentication](https://docs.qualflare.com/docs/administration/account-security#two-factor-authentication-2fa) | Workspace | Delete | Owner | | Delete a project | Workspace | Delete | Owner | In the web app, **Delete Project** shows only to the project's Owner, so deleting needs the Owner role in both the workspace and the project. ## How workspace and project roles combine * Your workspace role applies in every project in the [workspace](https://docs.qualflare.com/docs/reference/glossary#workspace). * A project role can raise your access in that project, never lower it. Qualflare checks your project role first, then your workspace role, and allows an action if either one allows it. * For example, a workspace Viewer with the Editor role in Project A can edit Project A. * Lowering someone's workspace role doesn't change the roles they hold in projects. * The Guest workspace role grants nothing on its own, so Guests reach only the projects they were invited to. | Workspace Role | Project Role | Effective Permission | | -------------- | ------------ | --------------------------------------------- | | Viewer | Editor | Editor in this project | | Maintainer | Viewer | Maintainer in this project | | Guest | Viewer | Viewer in this project, and no other projects | | Editor | (none) | Editor (inherits the workspace role) | In the web app today, the **Projects** page lists only the projects you're a member of, and most buttons inside a project follow your project role. If a project is missing, ask a workspace Maintainer or Owner who is in that project to invite you. If a button is disabled even though your workspace role allows the action, ask a Maintainer or Owner of the project to promote your role on its **Settings** > **Users** page. No setting hides a project from workspace members. To keep someone out of most projects, see [Limit someone to specific projects](https://docs.qualflare.com/docs/administration/users#limit-someone-to-specific-projects). ## Workspace pages by role The workspace sidebar shows only the pages your role can open: | Page | Sidebar group | Least workspace role | | --------------------- | -------------- | -------------------- | | **Projects** | (none) | Any member | | **Plan & Billing** | Management | Owner | | **Tags** | Management | Viewer | | **Integrations** | Management | Editor | | **Users** | Management | Viewer | | **Audit Logs** | Administration | Maintainer | | **Single Sign-On** | Administration | Owner | | **Verified Domains** | Administration | Owner | | **SCIM Provisioning** | Administration | Owner | | **Authentication** | Administration | Owner | | **Settings** | Administration | Viewer | ## Rules for changing roles * **Promote** and **Demote** move one step at a time: Guest โ†’ Viewer โ†’ Editor โ†’ Maintainer. Promote stops at Maintainer, and Demote stops at Viewer. * Change a workspace role on the workspace **Users** page, and a project role on the project's **Settings** > **Users** page. * Maintainers can't change or remove an Owner, and nobody can change their own role. * Owners can't leave a workspace. For the steps, see [Change a member's role](https://docs.qualflare.com/docs/administration/users#change-a-members-role). ## Related * [Invite and manage users](https://docs.qualflare.com/docs/administration/users) * [Workspaces and Workspace Settings](https://docs.qualflare.com/docs/administration/workspaces) * [Project Settings](https://docs.qualflare.com/docs/administration/project-settings) * [Project teams](https://docs.qualflare.com/docs/administration/teams) * [SSO & SCIM Provisioning](https://docs.qualflare.com/docs/administration/sso): the roles SSO and SCIM give new members * [Audit Logs](https://docs.qualflare.com/docs/administration/audit-logs): the record of role changes